File Exposure Risk in OpenEJB HTTP Server by Apache Software Foundation

CVE-2026-97881

What is CVE-2026-97881?

The OpenEJB HTTP server contains a vulnerability where static resource paths are not properly restricted to configured resource directories. This flaw allows remote, unauthenticated attackers to access arbitrary files that are accessible to the server process. To mitigate potential risks, it is advised to block network access to the embedded HTTP server from untrusted clients or consider transitioning to the Tomcat-based TomEE distributions for better security.

References